Sanga,
Let's go through the basics
When you first plug in your router to the power outlet, do you get a solid orange/amber light? If so, read on because your router is bricked.. If not, I don't know what you got yourself into!
1- did you assign your PC a static ip address like 192.168.1.10? Did you put your default gateway as 192.168.1.1? If you did see #2
2- When you ping (ping -t -w 2 192.168.1.1) your router. are you getting 100% return? If you have the solid orange light, you will never hear back from your router, it will say something like "Timed Out"
Here is what I did to get mine to work
-Downlaod the latest firmware from netgear and rename it to WNR3500.chk
-Save it on your C drive
-Open cmd
-Type "cd\" and hit "enter", this will move you to the C drive
-Type "tftp -i 192.168.1.1 PUT WNR3500.chk" DON'T PRESS "ENTER"
-Now plug in the power to your router while holding a screw driver in your hand
-wait until all lights flashes and then short the 2 pins shown in Fabian pic
-while having your screwdriver on the 2 pins, go to the cmd window and press"ENTER"
- wait until you get a confirmation that the file transferred sucessfuly==> Then my lights started blinking green==>
-Now put your screwdriver on the table and press the "upward" arrow and then press "enter" to send the firmware file a second time.
- The light color will change from blinking green to blinking orange... wait... wait... wait... wait 5 minutes and the router will be restored.
Hope this helps
How To Debrick Your NETGEAR WNR3500L Using A USB-TTL Cable on Windows
Categories: Troubleshooting
kosskossy,
- Yes, I have assigned static IP.
- My router comes on with the green power LED flashing, not amber.
- Pinging it gives me 100% return with TTL=100, which I read on the forums to mean it's ready to accept tftp.
- Every time I tftp a .chk file it tells me it's successful, but it just keeps on blinking green with ping replies and TTL=100
- Guess I have a different problem than you!
This definitely was not my case because everytime I plugged in the power, I ended with a solid amber light and then when I send the firmware.chk for the first time, I get the green blinking light and when I send the firmware.chk for the second time, I get the blinking amber light and within 4 minutes I get the solid green light = restored to original status.
Honestly I am puzzled... but as you said the blinking green light means that it is ready to take a firmware file
Why don't you do the following
-Don't short anything, just send firmware.chk a couple of times and see where you end up.
- Try Erase Linux again
Keep tinkering.. there must be a fix and make sure you share.. Best of luck
I've tried sending the firmware many, many times, at different points in time after plugging in the router - no go.
I can't do erase linux again because the router has no OS and doesn't provide a telnet shell. It's stuck listening for a tftp firmware.
I found that you will need to pull up on the unscrewed end before sliding. It does come out first try rather nicely though. ;)
After xxx unlucky attempts to unbrick, following this tread and others, I once again looked in to this and followed Kosskossy's Basic's.
And .... BANG !
Router is now up and running as nothing ever have happened.
it would be amazing if netgear would incorporate a already wired in usb-ttl into their next open router product!
just have an external usb port that provides a serial port, making debricking a trivial task!
rather than madly pinging at 192.168.1.1
if you perform a tcpdump or wireshark, youll see that the modem will actually GARP its ip address of 192.168.1.1
its at this stage you can put a screw driver (or the screw from the case worked fine), which will have the router blink the power lamp gren. you can then send the .chk file via tftp.
- member since: 01/02/2008
- rank: 2 of 30045
- 50 articles authored
- 5 blog entries posted
- 96 forum threads started
- 271 comments
@Dean - I can't agree with you enough. It would really make it a LOT easier to perform recoveries with a USB-TTL cable, without the need for soldering or opening up the case. I hope we get to see this in future products.
Many thanks to Fabian and Kosskossy for the wonderful job they've done.After flashing wrong dd-wrt i got my wrn-3500l bricked with only amber lights shining.
Following the instructions by Kosskossy i revived my router.I found that ttl cable is very hard to get in my country/Bulgaria/ and this method saved me time and money.Thanks again guys!!!!
If anyone has trouble getting the TTL cable then let me know. If I have enough requests I'm willing to do a bulk order from a seller and ship out to those that need it regardless of location. UPS, Airmail (for international), and USPS (for domestic) would be available for use.
You can send a PM with the request. I'll check it periodically.
@dudi Well done mate... excellent English by the way :)
I am curious to find out if anyone has sucessfully installed tomato on a netgear "WNR3500 V2", which is very specific to North America. If so, can you post a link to the firmware that you used for flashing?
@kosskossy,
I have installed Tomato on my WNR3500v2 (after some trials and tribulations).
(You are aware of my previous de-bricking difficulties, which I finally solved with a serial connection and diagnosed a bad byte in the board_data partition of the core Broadcom firmware. Long story.)
If you have DD-WRT on your router, the linux partition that DD-WRT reserves is too small for most Tomato builds. However, beta 14 of teddy_bear's Tomato build fits. So you MUST flash with beta 14 first - after that, you can load any version of Tomato (and back to DD-WRT if you wish). Personally, I had some issues with beta 11, but YMMV. There is a "mini" version of beta 16 designed to fit on WNR3500v2 for the initial flash - but DO NOT flash this build, it bricked my router. The standard size beta 16 is fine to flash after flashing beta 14. Note that beta 16 std takes a long time to boot on Netgear routers - don't worry, teddy_bear is working on beta 17 with a fix.
Nice effort, NETGEAR.
I really do appreciate NETGEAR attempting to break the ice with the open source router. I'm sure that they understand what people are doing with their existing routers, and this is a nice way to go about it. In the future, here's what I would change:
1. Add an external serial port, even if it is wired to RJ45 or RJ11 plug. The cost of a serial transceiver is insignificant.
2. At least let the CFE bootloader perform tftp flashing within the boot_wait time. This might even be enough to ignore #1, since you can almost always recover from a bad flash / configuration with this. Pretty much every other broadcom router has this ability, and I'm not sure why this one does not.
3. Use an Atheros chipset for the SoC and wifi. This will get you a true open source driver so that you are not stuck with a particular kernel version. Broadcom has done well, but Atheros based platforms get the love from the open source community since there is no reverse engineering involved. The Ath5k and Ath9k drivers are solid, and this is why the NETGEAR WNDR3700 is well supported by OpenWrt but the WNR3500L is not.
I'm looking to get OpenWrt running on the WNR3500L, built from source. Unfortunately, the source on myopenrouter.com pulls against trunk svn on dev.openwrt.org, and it no longer patches cleanly. Sure, I could pull the same revision that the patch was made from, but it would be really nice to have everything in the OpenWrt svn.
Unfortunately, I can get a Buffalo wzr-hp-g300nh (comparable) for about the same price, and it has much better OpenWrt support.
Also, my trusty serial cable does not work with this router. I've used it on plenty of broadcom based routers without issue. It has a Sipex sp3232ebcn serial transceiver, which has always worked for me. I get garbage on the serial port, mixed in with the occasional valid serial data. I am going to verify ground again, but I don't see what the issue is.
Great guide!
I debrick my netgear wnr3500l with USB-TTL on Nokia CA-42 cable (5 wires on OTI 6858). Really, this cable is cheaper!
Thank you Peter!
Hi !
I've the same problem. Here is my solution :
Define on your pc this config:
192.168.1.10/255.255.255.0
gtw & dns : 192.168.1.1
1/ Proceed to 30/30/30 reset
2/ Copy from cdrom E:\bin\TFTP\Core\Drivers\WW\WNR3500L.chk to c:\WNR3500L.chk
3/ open cmd command in windows :
C:\>tftp -i 192.168.1.1 PUT WNR3500L.chk
Transfert réussi : 5439546 octets en 3 seconde(s), 1813182 octets/s
After, the led is orange
4/ poweroff alimentation
5/ poweron alimentation
6/ when LED is yellow blinking, enter again :
C:\>tftp -i 192.168.1.1 PUT WNR3500L.chk
Transfert réussi : 5439546 octets en 3 seconde(s), 1813182 octets/s
Please be patient few minutes (~5 minutes)
Led is Yellow, not blinking ! Router is working :)
Default firmware is not installed !
I don't know if this solution will work on all routers... but I have unbrick my router without connect any usb/ttl cable.
My method is similar to http://www.myopenrouter.com/article/13859/How-To-Debrick-Your-NETGEAR-WNR3500... without open the box :)
Have fun ;)
Mr Xhark (http://blogmotion.fr)
Personal blog : http://blogmotion.fr
Hi !
I've the same problem. Here is my solution :
Define on your pc this config:
192.168.1.10/255.255.255.0
gtw & dns : 192.168.1.1
1/ Proceed to 30/30/30 reset
2/ Copy from cdrom E:\bin\TFTP\Core\Drivers\WW\WNR3500L.chk to c:\WNR3500L.chk
3/ open cmd command in windows :
C:\>tftp -i 192.168.1.1 PUT WNR3500L.chk
Transfert réussi : 5439546 octets en 3 seconde(s), 1813182 octets/s
After, the led is orange
4/ poweroff alimentation
5/ poweron alimentation
6/ when LED is yellow blinking, enter again :
C:\>tftp -i 192.168.1.1 PUT WNR3500L.chk
Transfert réussi : 5439546 octets en 3 seconde(s), 1813182 octets/s
Please be patient few minutes (~5 minutes)
Led is Yellow, not blinking ! Router is working :)
Default firmware is not installed !
I don't know if this solution will work on all routers... but I have unbrick my router without connect any usb/ttl cable.
My method is similar to http://www.myopenrouter.com/article/13859/How-To-Debrick-Your-NETGEAR-WNR3500... without open the box :)
Have fun ;)
Mr Xhark (http://blogmotion.fr)
Personal blog : http://blogmotion.fr
I used kosskossy's method of shorting the two pins. I did not need the serial cable, but I am going to buy one just in case the shorting method does not work.
Now I do have to admit from a tech prospective, shorting is not always good and can cause more harm than good if you don't know what your doing or or make the mistake of being charged with static, etc. I would say that the serial method is much safer. I had nothing to loose cause I was within the return period.
- member since: 01/02/2008
- rank: 2 of 30045
- 50 articles authored
- 5 blog entries posted
- 96 forum threads started
- 271 comments
@SirDragonx - I hear you - I've never even tried the pin short method myself! I've always found the serial cable to be indispensable.
Some good news for you I think...just bought a new WNR3500L from Best Buy and it has the pinnouts pre-soldered in. I know you mentioned earlier that they removed the pinnouts at some point but were planning on reintroducing them. Perhaps that's been done? If I can find out how to tell the version number of the router perhaps we could confirm whether or not this was a new change in the manufacturing process.
I found this site after doing a bit of digging to find a Gigabit/N-capable router that supported Tomato, which is the firmware I use on my Linksys WRT54GL right now. I want to be able to enable Jumbo Frames on it to make full use of this Gigabit network I've built here.
Thank you very much for posting this. It saved my router when I flashed a bad version of the firmware.
- member since: 01/02/2008
- rank: 2 of 30045
- 50 articles authored
- 5 blog entries posted
- 96 forum threads started
- 271 comments
@Hablutzel - Love to hear that this helped you out. Keep on enjoying your router!
Hi,
I've managed to solder USB->TTL converter to my WNR3500L router.
I'm able to stop the router boot process and get an access to the serial console (CFE>)
First question:
Is there available list of the CFE prompt commands? In other bootloaders I can type "help", and I know everything. Here such hint is not available.
Another issue. I was working with DD-WRT at WNR3500L. Then I've realized, than it would be nice to give a try to OpenWRT (8.09 from myopenrouter site). Unfortunately Web GUI for dd-wrt only support bin images. So I decided to flash the router with the "USB-TTL cable less" method.
My lack of timing has caused that, I bricked my router :-)
Now I have access to the router's serial console.
I can stop boot process and see the prompt: CFE>
I'm able to start TFTP and download the WNR3500L-V1.0.2.50_31.1.25.chk image.
Unfortunately my router doesn't want to flash this image since the checksum is different.
Console output:
Boot partition size = 262144(0x40000)
Found a 8MB ST compatible serial flash
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.10.56.28
CPU type 0x19740: 453MHz
Tot mem: 65536 KBytes
Device eth0: hwaddr C0-3F-0E-XX-YY-ZZ, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Checksum mismatch:
Image chksum: 0xFFFFFFFF
Calc chksum: 0x09F603FC
Invalid boot block on disk
Above is after power-on. It is obvious, that I've erased MTD flash, but not upload any new firmware.
Reading :: Done. 5330293 bytes read
Checksum mismatch:
Image chksum: 0xDC96E81D
Calc chksum: 0x248F2119
Any hint on that? It is the comparison of checksum from image and the one calculated by CPU. They should match, but for some reason they did not.
Any help?
kosskossy said: Sanga, Let's go through the basics When you first plug in your router to the power outlet, do you get a solid orange/amber light? If so, read on because your router is bricked.. If not, I don't know what you got yourself into! 1- did you assign your PC a static ip address like 192.168.1.10? Did you put your default gateway as 192.168.1.1? If you did see #2 2- When you ping (ping -t -w 2 192.168.1.1) your router. are you getting 100% return? If you have the solid orange light, you will never hear back from your router, it will say something like "Timed Out" Here is what I did to get mine to work -Downlaod the latest firmware from netgear and rename it to WNR3500.chk -Save it on your C drive -Open cmd -Type "cd\" and hit "enter", this will move you to the C drive -Type "tftp -i 192.168.1.1 PUT WNR3500.chk" DON'T PRESS "ENTER" -Now plug in the power to your router while holding a screw driver in your hand -wait until all lights flashes and then short the 2 pins shown in Fabian pic -while having your screwdriver on the 2 pins, go to the cmd window and press"ENTER" - wait until you get a confirmation that the file transferred sucessfuly==> Then my lights started blinking green==> -Now put your screwdriver on the table and press the "upward" arrow and then press "enter" to send the firmware file a second time. - The light color will change from blinking green to blinking orange... wait... wait... wait... wait 5 minutes and the router will be restored. Hope this helps
I tried this over and over again until I wen't totally bat-**** crazy...
I used an ubuntu 10.10 with tftp package. But no luck..
Then in pure desperation I booted up an virtual XP in VirtualBox and tried the same.
First try, the leds turned from blinking green to orange.. And now the router is up and having a nice time again..
Thanks for the Tip!
RSS
